---
title: "Regulatory Alert: CDSL Mandates Submission of VAPT Findings Closure Reports Under SEBI’s CSCRF Framework"
date: 2026-03-07
author: "Tanvi Dalvi"
url: https://www.indialaw.in/blog/regulatory/cdsl-mandates-vapt-closure-reports-under-sebi-cscrf/
---

# Regulatory Alert: CDSL Mandates Submission of VAPT Findings Closure Reports Under SEBI’s CSCRF Framework

Posted On - 7 March, 2026 •

By - [Tanvi Dalvi](https://www.indialaw.in/author/tanvi-dalvi/ "Posts by Tanvi Dalvi")

[![text](https://www.indialaw.in/wp-content/uploads/xrify_4ck1w.jpg)](https://www.indialaw.in/wp-content/uploads/xrify_4ck1w.jpg)

On March 5, 2026, Central Depository Services (India) Limited (“CDSL”) issued Communiqué No. CDSL/OPS/DP/POLCY/2026/152, directing all registered Depository Participants (“DPs”) to submit compliance documentation pertaining to the closure of findings identified during Vulnerability Assessment and Penetration Testing (“VAPT”). This directive forms a critical component of India’s increasingly rigorous cybersecurity regulatory architecture and carries significant legal implications for financial market intermediaries operating under the supervision of the Securities and Exchange Board of India (“SEBI”). 

## Table of Contents

## **Regulatory Background and Legislative Basis** 

The present communiqué does not arise in isolation. It is grounded in an extensive chain of regulatory instruments, commencing with SEBI’s Cybersecurity and Cyber Resilience Framework (“CSCRF”) Circular No. SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, issued on August 20, 2024. This foundational circular established a comprehensive framework, governing cybersecurity obligations, applicable to all SEBI-regulated entities (“Res”). Subsequent clarification circulars issued by SEBI on December 31, 2024, March 28, 2025, April 30, 2025, August 28, 2025, and a Frequently Asked Questions document dated June 11, 2025, have progressively refined and elaborated upon the obligations enunciated therein. 

CDSL itself reinforced these obligations through Communiqué No. CDSL/OPS/DP/POLCY/2024/468 dated August 21, 2024, and further issued a detailed directive vide Communiqué No. CDSL/IS/DP/POLCY/2025/822 dated December 15, 2025, which specifically addressed the procedural requirements for VAPT report submissions. The March 2026 communiqué builds upon this established regulatory lineage, operationalising compliance requirements for a specific half-yearly reporting period. 

## **Scope and Applicability** 

The present compliance obligation is specifically directed at two categories of regulated entities: Qualified Stock Brokers (“QSBs”) and entities classified as Protected Regulated Entities (“Protected REs”). This categorical distinction is legally significant, as it delineates the precise class of DPs to whom this mandatory obligation attaches. Entities falling outside these classifications are not expressly covered under the current directive, though such entities would be well-advised to maintain vigilance regarding their own applicable cybersecurity obligations under the broader CSCRF framework. 

## **Nature of the Compliance Obligation** 

The substance of the directive requires DPs to submit a formal Action Taken Report (“ATR”) evidencing the closure of all findings identified during the VAPT exercise conducted for the half-yearly period spanning April 2025 to September 2025. VAPT, as a mandated cybersecurity assessment tool, serves the dual purpose of identifying systemic vulnerabilities within a regulated entity’s information technology infrastructure and providing a structured mechanism through which such vulnerabilities may be remediated under regulatory oversight. 

The legal significance of the ATR submission lies in its evidentiary character: it constitutes a formal representation by the DP to CDSL and by extension, to SEBI that identified security deficiencies have been addressed in a timely and efficacious manner. Failure to submit such a report, or the submission of an incomplete or inaccurate report, could expose the DP to regulatory inquiry, enforcement proceedings, or adverse findings under the applicable securities laws. 

## **Compliance Deadline and Procedural Requirements** 

The submission deadline prescribed by CDSL is March 31, 2026. DPs are required to transmit their VAPT ATRs exclusively via electronic mail to the designated address: dpinfosec@cdslindia.com. No alternative mode of submission has been prescribed or sanctioned. Given the proximity of the deadline to the date of issuance of the communiqué, DPs are urged to treat this as a matter of immediate priority and initiate the collation of requisite documentation without delay. 

## **Legal and Practical Implications for Depository Participants** 

From a legal compliance perspective, this directive reinforces the paramount importance of maintaining robust cybersecurity governance frameworks within regulated financial entities. Non-compliance carries the risk of regulatory censure, which, in the context of securities market intermediaries, can have far-reaching consequences including reputational damage, operational restrictions, or monetary penalties. Legal counsel advises that DPs treat the VAPT process not merely as a procedural formality, but as a substantive component of their enterprise risk management and regulatory compliance obligations. 

Furthermore, the iterative nature of SEBI’s clarificatory circulars signals a regulatory environment that is actively evolving. DPs and their legal advisors must maintain continuous engagement with emerging regulatory guidance to ensure that compliance programmes remain current and responsive to the dynamic cybersecurity landscape. 

## **Conclusion** 

CDSL’s March 2026 directive represents a concrete and time-bound expression of SEBI’s commitment to embedding cybersecurity resilience within India’s securities market infrastructure. For Depository Participants falling within the ambit of this directive, the obligation to submit VAPT Action Taken Reports by March 31, 2026 is unequivocal and non-discretionary. Our firm recommends that all relevant DPs undertake an immediate review of their VAPT findings, ensure that all identified vulnerabilities have been duly remediated, and submit their ATRs in accordance with the prescribed procedure. Proactive engagement with regulatory obligations of this nature not only ensures compliance but also demonstrates the institutional commitment to cybersecurity governance that regulators and stakeholders increasingly expect. 

For guidance on SEBI compliance, cybersecurity regulatory obligations, or assistance in preparing VAPT Action Taken Reports, please contact our Securities and Financial Regulations practice. 

For more details, write to us at: [contact@indialaw.in](mailto:contact@indialaw.in)  

[Regulatory & Compliance Advisory](https://www.indialaw.in/expertise/real-estate/regulatory-compliance-advisory/)

---

# IndiaLaw LLP — Offices & Contact Details

---

## General Contact

| | |
|---|---|
| **Website** | https://www.indialaw.in |
| **Primary email** | contact@indialaw.in |
| **Primary phone** | +91 836-9995919 |
| **Contact form** | https://www.indialaw.in/connect/ |
| **Careers (separate channel)** | https://www.indialaw.in/careers/ |


---

## All Offices (9 locations across 8 cities)

### 1. Mumbai — Registered Office & Head Office (Apeejay Chambers)

| | |
|---|---|
| **Address** | Apeejay Chambers, Ground Floor, Wallace Street, Fort, Mumbai – 400 001 |
| **Phone** | [022-6924-7400](tel:02269247400) |
| **Email** | contact@indialaw.in |
| **Page** | https://www.indialaw.in/mumbai/ |
| **Practice focus** | Litigation · Arbitration · Insolvency & Bankruptcy · Corporate · Banking · Real Estate · IP |
| **Notes** | The HQ. 5 partners based here. Handles PAN-India litigation, arbitration, corporate, banking, IP and real estate practice. Largest team across all offices. |

### 2. Mumbai — Non-Litigation Office (Excelsior, Fort)

| | |
|---|---|
| **Address** | 4th Floor, New Excelsior Theatre Pvt. Ltd., Amrit Keshav Nayak Marg, Fort, Mumbai – 400 001 |
| **Phone** | [022-697-40500](tel:022-697-40500) |
| **Email** | contact@indialaw.in |
| **Page** | https://www.indialaw.in/mumbai/ |
| **Practice focus** | Non-litigation only — consultations, negotiations, transactional work |
| **Notes** | Opened 2024. Litigation and arbitration remain at the Apeejay Chambers head office. |

### 3. Delhi

| | |
|---|---|
| **Address** | Flat No. 1107 & 1108, Prakashdeep Building, Tolstoy Marg, Connaught Place, New Delhi – 110 001 |
| **Phone** | (general line: +91 836-9995919) |
| **Email** | contact@indialaw.in |
| **Page** | https://www.indialaw.in/delhi/ |
| **Practice focus** | Litigation · Arbitration · Insolvency & Bankruptcy · Corporate · Banking · Real Estate |
| **Notes** | 3 partners based here. Located near the Supreme Court of India, Delhi High Court and other appellate bodies. |

### 4. Kolkata

| | |
|---|---|
| **Address** | Centre Point Building, Room No. 214, 2nd Floor, Premises No. 21, Hemanta Basu Sarani, Opp. Great Eastern Hotel, P.S. Hare Street, Kolkata – 700 001, West Bengal |
| **Phone** | [+91 33 4813 1001](tel:+913348131001) |
| **Email** | contact@indialaw.in |
| **Page** | https://www.indialaw.in/kolkata/ |
| **Practice focus** | Insolvency & Bankruptcy · Commercial & Civil Litigation · Arbitration · Banking Litigation · Real Estate · Labour & Employment · Consumer |
| **Notes** | Advises banks, NBFCs, MSMEs and corporates on transactions and dispute resolution. Works in close coordination with the Mumbai HO. |

### 5. Chennai

| | |
|---|---|
| **Address** | GF-A, 19 Casa Major Road, Egmore, Chennai – 600 008 |
| **Phone** | (general line: +91 836-9995919) |
| **Email** | contact@indialaw.in |
| **Page** | https://www.indialaw.in/chennai/ |
| **Practice focus** | Litigation · Insolvency & Bankruptcy · Real Estate |
| **Notes** | Full-fledged office with experienced legal team. Supported by Mumbai HO. |

### 6. Bengaluru (Bangalore)

| | |
|---|---|
| **Address** | INDIALAW LLP, No. 7 Chinnaswamy Mudaliar Road, Shivaji Nagar, Bangalore – 560 051 |
| **Phone** | [080-4167-2444](tel:08041672444) |
| **Email** | contact@indialaw.in |
| **Page** | https://www.indialaw.in/bengaluru/ |
| **Practice focus** | Litigation · Insolvency & Bankruptcy · Real Estate · Family Laws · Labour |
| **Notes** | Located near Bangalore High Court. Handles corporate, commercial, banking and matrimonial disputes. |

### 7. Hyderabad

| | |
|---|---|
| **Address** | 403, 4th Floor, Sanatana Ecstasy Building, beside Tanishq Show Room, Himayathnagar, Hyderabad – 500 029, Telangana |
| **Phone** | [040-6666-5166](tel:04066665166) |
| **Email** | contact@indialaw.in |
| **Page** | https://www.indialaw.in/hyderabad/ |
| **Practice focus** | Litigation · Banking · Insolvency & Bankruptcy · Real Estate |
| **Notes** | Particularly well known for complex banking matters and real estate transactions. |

### 8. Cochin (Kochi)

| | |
|---|---|
| **Address** | Second Floor, Pulikkal Building, K.K. Padmanabhan Road, Ernakulam North – 682 018, Kerala |
| **Phone** | [0484-3583961](tel:04843583961) |
| **Email** | contact@indialaw.in |
| **Page** | https://www.indialaw.in/cochin/ |
| **Practice focus** | Litigation · Insolvency & Bankruptcy · Real Estate |
| **Notes** | Commercial disputes, property litigation, financial-claim arbitrations and real estate transactions. |

### 9. Noida (NCR)

| | |
|---|---|
| **Address** | No. 16 & 17, Silver Offices, 17th Floor, Wave One, Sector 18, Noida – 201 301 |
| **Phone** | (general line: +91 836-9995919) |
| **Email** | contact@indialaw.in |
| **Page** | https://www.indialaw.in/noida/ |
| **Practice focus** | Aviation · Insurance · Mergers & Acquisitions · Corporate |
| **Office head** | **Mr. Dinesh Gupta** (joined August 2025 to lead and expand the corporate practice) |
| **Notes** | Newest office. Sector-focused on highly regulated industries serving NCR-based clients. |

---

## Quick-Dial Phone List

| Office | Phone |
|---|---|
| Mumbai HO (Apeejay) | 022-6924-7400 |
| Mumbai Excelsior | 022-697-40500 |
| Kolkata | +91 33 4813 1001 |
| Bengaluru | 080-4167-2444 |
| Hyderabad | 040-6666-5166 |
| Cochin | 0484-3583961 |
| **General / Marketing line** | **+91 836-9995919** |

Delhi, Chennai and Noida route through the general number.

---

## Social Channels

- LinkedIn: https://www.linkedin.com/company/indialaw
- X / Twitter: https://twitter.com/Indialawmumbai
- Facebook: https://www.facebook.com/indialawllp/
- Instagram: https://www.instagram.com/indialawllp

---